[XPERIA X10 Android Development] MrHassell:
Marlin DRM

SE used something different to HTC. They use the Marlin DRM and RSA encryption handled by way of a framework which implements a key derivation system or DRM engine.

Marlin hooks are issued from the EPROM (this can never be modifed, it's a write once operation and can never be flashed like a firmware) to do some validations before passing off to the boot loader, it's all a little strange so I'm going to explain what I see... the encryption takes place via the network and matches based on local copies of the certificates - there is considerable talk about these certificates red (retail) / brown (engineering) etc.. it integrates with the DRM, via the Marlin framework. Cryptographic operations (e.g., encryption, signature verification, etc.) are handled by crypto services block 1314.

urn:marlin:datacertification:revocation

urn:marlin:peerinteraction

urn:marlin:drmservices

References the Octopus DRM. Appears SE used a specific framework for encryption. However to understand what Marlin is head on over to their homepage and for the record.. they use Drupal.. need some web developers over there guys?! :eek:

"The Marlin Trust Management Organization (MTMO) is the operational entity that grants commercial licenses for Marlin technology. It is established by the five Marlin founders – Intertrust, Panasonic, Philips, Samsung, and Sony."

Oh so who are intertrust.com - have a look at that while your at it if you like cant h-ARM.. pardon the pun...

"Canvas selects Marlin DRM for its Internet-connected TV platform"... these guys are way out of date.. they use Coldfussion and the links don't even work! ha.. What they are trying to get you to NOT look at here is this. I'm really not sure that You View will ever take off... after all I have a TV and a phone with Youtube.. what more could I possibly want.. :o

By the way Marlin is not this: http://ilcsoft.desy.de/portal/software_packages/marlin/ Although it looks more interesting :D

Here is what Marlin get's up to when it's not being a fish. I've extracted URL's and this one specifically is used for certificate revocation, load it and look at the funky message - ha :rolleyes: - it's specificly issued to a receiver and errors because your web browser isn't calling correctly as the 'fish in your phone' will.

http://testcrl.marlin-tmo.com/testcrl/mtmocrls.crl

There is the cert - sonyericsson.crl - Certificate Revocation List Information:

Version: V1

Issuer: CN = Chorus OMA Root TEST Certification Authority for SONY ERICSSON

OU = FT/DAC/DT

O = France Telecom Group

Oui!? Ca Va?

Effective date: ‎Tuesday, ‎15 ‎May ‎2007 1:27:58 AM

Next update: ‎Monday, ‎10 ‎May ‎2027 1:27:58 AM

Signature algorithm: md5RSA

Signature hash algorithm: md5

The order of encryption in transactions from EPROM > Boot

S1_SL_test_Root_f6630

S1_SL_test_f6630

SEMC_TEST

SEMC DRM1 :: SEMC DRM Root CA Test & SEMC DRM Device CA 1 Test

falls back to..

SEMC DRM0

Then: - VIACCESS_TEST | 0R1 | France Telecom Group1 | Chorus OMA Root TEST0

http://preprod.crl.dac.pki.purpledrm.com/crlfiles/chorus_ca_root_01.crl

At this point x10 has loaded - sonyericsson.crl - Chorus OMA Root TEST Certification Authority for SONY ERICSSON

So what just happened? The GSM base band initialized and used the network present to call this url and update revocation lists against the current cert that it has - hash matches.

SONY ERICSSON, Inc | Chorus Service | TEST OMA DRM Agent

http://roap.pp.purplecast.com/crl/sonyericsson.crl

Yer.. some things took place here... just downloaded the updated certificate revocation list (crl). Now the part that I'm interested in and would like anyone to put some light on the subject as a lot of events take place here, I'm unable to see or look inside at this point, just encoded text masking network activity, so can't see the methods or begin to guess as to what is taking place, other than some thorough checking of certificates matching against signatures and performing revocation, this being the case... let's say one of the cert's is compromised and a pass phrase is obtained.. C'est si bon!

MARLIN_TEST

{methods / network utilization}

urn:marlin:peerinteraction

urn:marlin:organization:seacert:peerinter

Marlin framework appears to be getting this url from the drm - http://marlin-tmo.com/testcrl/mtmocrls.crl

0-1+0

urn:marlin:datacertification:revocation

urn:marlin:organization:seacert:peerinter

urn:marlin:organization:seacert:semc:peerinter

0<1:08

http://testcrl.marlin-tmo.com/testcrl/mtmocrls.crl

urn:marlin:datacertification:revocation

urn:marlin:organization:seacert:semc:peerinter

0A1?0=ACK (acknowledged)

urn:marlin:organization:seacert:semc:clientnemo: (client-id)

http://testcrl.marlin-tmo.com/testcrl/mtmocrls.crl

urn:marlin:datacertification:revocation

Payload!

(in your hand)

urn:marlin:core:role:device

(what you are)

urn:marlin:core:role:drm-client

(some stuff)

urn:marlin:core:client:capabilities

urn:marlin:broadband (versions major / minor)

urn:marlin:broadband:client (urn:marlin:organization:semc)

<SignedInfo>

<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>

<Reference URI="#AQAAO7gn">

<Transforms>

<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

</Transforms>

<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>

<DigestValue>SWnFxoSIJZSCHQ4Q5bNmnSchrpE=</DigestValue>

</Reference>

</SignedInfo>

and...

<SignatureValue>Ti+kfuL/4kRvOj95NcZGaklrVRQ923cSd8LxnqsW7cBlnaqzPNeKNAmGqz5AESP6JQu7txYqKJ5U

ZvtkRvY1e8EOke0kqc8XCslmN6cGw4ZYAMRnCJ1KnlS1zUigAIXsW62xNiv149MaRCibylrQQSMK

sMiorLoEcgDmzTiT3qe79afQBeU4MCHDak+/d80QbE5kQ7k7xD+fhgvfeGy6liM5EDdf0ABAq8GO

OC10AgF8tsti+6Kks9uOhQMzRlRUa32P/gdP4ZiSccC/zDojyGJwo4fWDWdppcqS0WjG8/vmdRrC

lme2AkTyu9n2MqtN0JFMVSsPsp6cptJtSAL+Mg==</SignatureValue>

voila!

<KeyInfo>

<X509Data>

<X509Certificate>MIIEETCCAvmgAwIBAgIIWS+UYwsuhb8wDQYJKoZIhvcNAQELBQAwOTE3MDUGCysGAQQBgbkvAQEB

DCZ1cm46bWFybGluOm9yZ2FuaXphdGlvbjpzZWFjZXJ0OmRybXN2YzAeFw0wOTEwMTMwMzA3MDVa

Fw0yNDEwMTMwMzA3MDVaMEAxPjA8BgsrBgEEAYG5LwEBAQwtdXJuOm1hcmxpbjpvcmdhbml6YXRp

b246c2VhY2VydDpzZW1jOmRybXBlcnNvMIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA

qctpmGnpmkD/F2pC1m6CsrkZBZwMFZ4bcqwY9u6vZ8oNAQnEMuXTUWIcmKMNLrtyjY1PvX/6ZQMs

wLmyraOtaf1/S+Q80PQxFFuzBPj58CYVRM58+TxP1RrmT2W5lA9WSdm4wIXGDuFxjRLBJrhbQ9eX

dGmM3Gi3z6UbBDBl6aPmNaYFTU9qYSZnd+Cg/738QlGxRYTr47A2cxTXweWz9XC52fMe4dDgH70r

hCVtirYdqthv0iwi9gQ8V54XFxOjUB+t/dfbyHO3k9zGq3JehtWPJ8qfYGyQJsmx0hHVsziRB1FK

z7U1wV145Jgqotn33uFiF+RT7DUivgo2LX7mOQIBA6OCARYwggESMB8GA1UdIwQYMBaAFOBw1+ME

CjesVkcf+1+0PPMyuDlWMB0GA1UdDgQWBBRiDdkFJ0eHf6UV/rUYmsiofUwwNjAOBgNVHQ8BAf8E

BAMCB4AwDAYDVR0TAQH/BAIwADAsBgNVHSABAf8EIjAgMA4GDCsGAQQBgbkvAgIKAzAOBgwrBgEE

AYG5LwECCgYwgYMGA1UdHwR8MHoweKA2oDSGMmh0dHA6Ly90ZXN0Y3JsLm1hcmxpbi10bW8uY29t

L3Rlc3RjcmwvbXRtb2NybHMuY3Jsoj6kPDA6MTgwNgYLKwYBBAGBuS8BAQEMJ3VybjptYXJsaW46

ZGF0YWNlcnRpZmljYXRpb246cmV2b2NhdGlvbjANBgkqhkiG9w0BAQsFAAOCAQEAeiT0p5PZBiJz

rjeK0nlo/QUERHM6ARaKOxtcl8Ai5Q0HIEY3Uc4X4EjMP8oZd5KRGRxo4mju2Hy0OnsDD9Ej0u4O

j+QTiaIB1VimLfZ4WJKeVp0Oqtcq82EX6kT/13as8FwmmdTxY5j9VHNNSCIjAAVKLoXu1vO76LfI

wYVIWdK1VA+C9TaVsMTLi/nS2wX4ICOonIJrtxYf+jP2o8o+Qhee0mmscFSLavx85nDsuUfx7jcV

SnYQAMpy3naKMEudgFdS57gh6lVyEeyuNtTFr5gPNpIRHFYj3cUoCQs+jv2fm98a7BaZIwR8QQK3

fAqrs5vr9cR15HGUUlHF5wJNBg==</X509Certificate>

<X509Certificate>MIID2jCCAsKgAwIBAgIIeM2wJL6QchwwDQYJKoZIhvcNAQEFBQAwKTEnMCUGCysGAQQBgbkvAQEB

DBZ1cm46bWFybGluOmRybXNlcnZpY2VzMB4XDTA4MDIwMjAzMTQxN1oXDTI4MDIwMjAzMTQxN1ow

OTE3MDUGCysGAQQBgbkvAQEBDCZ1cm46bWFybGluOm9yZ2FuaXphdGlvbjpzZWFjZXJ0OmRybXN2

YzCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAJOpmMkWtBZrtioQF9WU1pV2bZLepxzm

8rdvpVAj3QrxcrdkQb0B7mnoyMxBptNg4hrDBUS9n2vjgc+tBMXS3of0OsS5MJfWnRXMTqhgXd1F

pduh/uBkw8KrvJfT/An48+TUk5QX8kfDDOMitCl0/S1jxraY9tVKxMibibI853+e8FeGQvrL0QBq

LLs/yKBt/gcLV0T3j0SglOB59wPjazHrYq/ojMN71p9BQf5eUPGchGmteqrjpQyx4kxjYIHP9p2c

qf7HAD5ncekFUtCeDSN2YrCE2EWwQoJeWn3H7yg/wcHFK4e+qp4EVzJCMFylMVm4nLo9ekjt6KFM

RCB7ZNkCAQOjgfcwgfQwHwYDVR0jBBgwFoAU+vKxT/YiIiTzXenGvy47mAy7qGswHQYDVR0OBBYE

FOBw1+MECjesVkcf+1+0PPMyuDlWMA4GA1UdDwEB/wQEAwIChDAPBgNVHRMBAf8EBTADAQH/MHsG

A1UdHwR0MHIwcKAuoCyGKmh0dHA6Ly9tYXJsaW4tdG1vLmNvbS90ZXN0Y3JsL210bW9jcmxzLmNy

bKI+pDwwOjE4MDYGCysGAQQBgbkvAQEBDCd1cm46bWFybGluOmRhdGFjZXJ0aWZpY2F0aW9uOnJl

dm9jYXRpb24wFAYDVR0gAQH/BAowCDAGBgRVHSAAMA0GCSqGSIb3DQEBBQUAA4IBAQBZdmT197zL

gyP1fE05a11ONh6TRcBm90S++RxX81zuD3nt8H6w5jrG886THqaSe8XXTbYNGNovOACIdzM5kxgq

CAROCWamtw2qq8MlRmxDzmGZBwWkPfIU+zeSwhHbrbUtHF3nfWxzPnEPwvuPg5cX5a8gbUJAKE+G

4Qi7NwZoUeV9rSYgTiXB+IWW3VYaXd2hl3rsY+JO16AwA4j3hvRO31jJv0U8qYbPZmm12cUJRgYz

IOeKEehq9nO7kjmYP8e9CFWtrU5wSTheU9Bx3Pxk4TvkvkIVX3dWiRV0BcIESJFOVQUwY33AqQbE

lmXdVzUbUbvDvxd2kSmtnfOruKoi</X509Certificate>

</X509Data>

</KeyInfo>

So now we have all this crap on our screens? Can we unlock the boot loader now... please? In a word no... This was just the reference for your device profile - Here comes the DRM bundle of joy!

IF 0!1 (not true)

urn:marlin:tmo

urn:marlin:peerinteraction

urn:marlin:drmservices

urn:marlin:datacertification

etc... around we go - loop de loop...

then!

S1_HWConf_Root_ee5d0

S1_HWConf_ee5d0

We have arrived - you may use your phone.

S1_EROM > S1_Cust > S1_SW > commands follow.. (1227-4612_R1FA010 - 1232-9897_R5A etc...)

EDIT: If your really interested in how a DRM works with your phone > head over here and have a read!

EDIT2: Interesting... asahi_externs.c (GetCertPtr) ERROR! Trying to fetch a test certificate with security state on. (OK.. lol?)

S1_SL_test

S1_SW_test

S1_EROM_test

S1_Loader_test

S1_Cust_test

S1_HWConf_test

S1_SL

S1_SW

S1_Loader

S1_Cust S1_HWConf